Email Compliance in Plain English: CAN-SPAM and GDPR Basics

If you send marketing email, a few legal rules apply to you no matter how small your business is. The good news is that the core requirements are straightforward, and following them also tends to make your emails perform better. This guide summarizes the U.S. CAN-SPAM Act and the consent basics of the EU and UK GDPR in plain English.

Which rules apply to you

As a rough guide, the rules that matter depend on where your recipients are, not just where your business is based:

• Recipients in the United States: the CAN-SPAM Act applies to commercial email.
• Recipients in the EU or UK: the GDPR (or the UK GDPR) governs how you handle personal data, and separate electronic marketing rules (the ePrivacy rules in the EU, and the Privacy and Electronic Communications Regulations, or PECR, in the UK) govern marketing emails specifically.
• Recipients elsewhere: other countries have their own laws. Canada's anti-spam law (CASL), for example, is generally stricter than CAN-SPAM about consent.

Many small businesses have subscribers in several countries. The simplest approach is to adopt the stricter practices, especially clear opt-in consent, for everyone.

CAN-SPAM: the U.S. rules

CAN-SPAM covers "commercial" email, meaning messages whose main purpose is to advertise or promote a product or service. It does not require you to get permission before emailing someone, but it sets rules for every commercial message you send. According to the FTC's compliance guide, the main requirements are:

1. No false or misleading header information. Your "From," "To," "Reply-To," and routing information must be accurate and identify who is sending.
2. No deceptive subject lines. The subject must reflect the content of the message.
3. Identify the message as an ad. You must disclose clearly that the message is an advertisement. The law gives you flexibility in how you do this.
4. Tell recipients where you are. Include a valid physical postal address. This can be your street address, a post office box registered with the U.S. Postal Service, or a private mailbox registered with a commercial mail receiving agency.
5. Tell recipients how to opt out. Include a clear, easy way to stop future emails, such as an unsubscribe link.
6. Honor opt-outs promptly. Process requests within 10 business days. Your opt-out mechanism must keep working for at least 30 days after you send. You cannot charge a fee, require information beyond an email address, or make people do more than reply or visit a single page to opt out. You also cannot sell or transfer the addresses of people who opted out.
7. Monitor others acting for you. If you hire an agency or contractor to send email, you remain legally responsible for compliance.

Messages that are mainly "transactional or relationship" content, such as receipts, account notices, or updates on a purchase, are largely exempt, though they still must not contain false or misleading routing information. If a message mixes promotional and transactional content, what counts is its primary purpose; the FTC guide explains how to judge this.

Penalties for violations can be significant and apply per email, so it pays to get the basics right.

GDPR consent basics

The GDPR applies to organizations established in the EU, and also to organizations outside the EU that offer goods or services to people in the EU or monitor their behavior. The UK has its own almost identical version, the UK GDPR. Both require a lawful basis for processing personal data, including email addresses.

For marketing email to individuals, the usual basis is consent. Under the GDPR, valid consent must be:

• Freely given: people must have a genuine choice. Do not make signing up for marketing a condition of a purchase unless it is necessary.
• Specific: consent to your newsletter is not consent to share data with partners.
• Informed: people should know who you are and what they are signing up for.
• Unambiguous and affirmative: a clear action, such as ticking an empty box or clicking a subscribe button. Pre-ticked boxes, silence, or inactivity do not count.
• Easy to withdraw: withdrawing must be as easy as giving consent.

The UK ICO's guidance on consent and gdpr.eu's overview of consent requirements explain these points in more detail.

The "soft opt-in" for existing customers

UK and EU electronic marketing rules include a limited exception, often called the soft opt-in. In the UK under PECR, it generally allows you to email marketing to existing customers about your own similar products or services, provided you collected their details during a sale or negotiation, gave them a clear chance to opt out at that time, and give them a way to opt out in every message. It does not apply to prospects who never bought or negotiated with you, and the detail differs between countries, so check the guidance for the countries where your recipients are.

People's rights

Under the GDPR, individuals have rights over their data, including the right to access it, correct it, have it deleted in many circumstances, and object to direct marketing at any time. An objection to direct marketing must always be honored.

Keep records

Good records are your best protection under every regime. For each subscriber, try to keep:

• When they subscribed and through which form, page, or event.
• What they were told at the time (the wording of the signup form or checkbox).
• Confirmation of double opt-in, if you use it.
• When and how they unsubscribed or withdrew consent.

Most email marketing tools and CRMs record signup source and time automatically. If you collect signups offline, write down the date and context and keep the forms.

A practical checklist

Next steps

Review your signup forms and your email footer this week. Check that unsubscribes are processed automatically by your email tool and synced to your CRM, so someone who opts out in one place is not emailed from another. Then get back to the fun part: building a list and writing emails people want. If you are choosing a CRM that will store this data, data export and privacy commitments are part of how to choose a CRM.